Neural Network Black-box Attack Defense Method Based on Knowledge Distillation

Abstract

The invention discloses a neural network black-box attack defense method based on knowledge distillation, which includes selecting multiple sub-networks to construct a teacher network, softening the input vectors of the softmax layer of all sub-networks, and then reloading the model parameter training of the sub-networks Obtain a new sub-network; obtain the predicted labels of each sub-network, and use the average or weighted average of all predicted labels as soft labels; input the ImageNet dataset into the student network, using soft labels, hard labels of datasets and black box model special Labels guide students to network training to obtain alternative models; use white-box attack algorithm to attack alternative models to generate adversarial sample sequences, and use adversarial sample sequences to attack black-box models, and select adversarial samples that successfully attack in the adversarial sample sequence; The adversarial samples are added to the training set of the black-box model, and the updated training set is used for adversarial training to generate a black-box model with defensive attacks.

Description

technical field [0001] The invention relates to a defense method of a neural network, in particular to a black-box attack defense method of a neural network based on knowledge distillation. Background technique [0002] The existing common black-box attacks are divided into migration-based training substitution model attack methods and decision-based multiple query estimation gradient attack methods. After generating a substitute model close to the black-box model and estimating the gradient close to the black-box model, the two use the mainstream white-box attack method to attack. [0003] Most of the former needs to know the training data set of the attacked model, as well as a lot of information other than the internal parameters of the model, such as input and output, when training the replacement model, and this information, especially the training data set, is difficult to know in practical applications, or The number of acquisitions is limited, so the method of gener...

AI Technical Summary

Problems solved by technology

[0005] In view of the above-mentioned deficiencies in the prior art, the neural network black-box attack defense method based on knowledge distillation provided by the present invention solves the problem of high computational complexity caused by multiple queries in the traditional method

Images